9.3 Organisational structure

Competent authorities should verify that the credit institution’s organisational structure demonstrates a solid organisation with the availability of effective reporting lines, allocation of responsibilities and risk measurement and management including subsequent monitoring, in order to ensure the credit institution’s sound and prudent management. The review should also include the organisational chart laying down the envisaged internal organisation in terms of departments, divisions, teams and related allocation of staff.

Competent authorities should carefully assess whether the submitted organisational structure

• – including the projected size, FTE number and systems – is commensurate with the business model, the types and geographical distribution of the activities and the risks that the applicant credit institution intends to undertake. Such an assessment should therefore be supported by the business plan reviewed in accordance with section 7 of these Guidelines.

For the purposes of granting the authorisation or of commencing the activities as the case may be, competent authorities should be sufficiently satisfied of the progress being made as regards the implementation of the organisational structure, including the progress in hiring the indicated personnel with the adequate qualifications.

Competent authorities should pay specific attention to avoiding the setting up of non-transparent or unnecessarily complex structures that have no clear economic rationale or legal purpose or that could be used for an objective connected to money laundering or other financial crimes⁵⁰ .

⁵⁰ Paragraph 76 of the EBA Guidelines on internal governance reads: ‘Institutions should avoid setting up complex and potentially non-transparent structures. Institutions should take into account in their decision-making the results of a risk assessment performed to identify whether such structures could be used for a purpose connected with money laundering or other financial crimes and the respective controls and legal framework in place [..]’.

When the business plan envisages the setting up of structures in other jurisdictions, competent authorities should assess the effective compliance of such jurisdictions with ‘EU and international standards on tax transparency, AML and CFT’⁵¹ . They should also assess the extent to which the envisaged structure serves an obvious and lawful economic purpose, or the extent to which it could be used to hide the identity of the ultimate beneficial owner, or whether the business strategy (including the customer’s request underlying the setting up of the structure) gives rise to concern. Competent authorities should assess whether the structure impedes appropriate oversight by the institution’s management body or the institution’s ability to manage the related risk, and whether the structure poses obstacles to effective supervision by competent authorities⁵² .

9.3.1 Corporate values, risk culture, code of conduct and governance policies

⁵¹ Paragraph 76, letter (a) of the EBA Guidelines on internal governance reads: ‘the extent to which the jurisdiction in which the structure will be set up complies effectively with EU and international standards on tax transparency, anti-money laundering and countering the financing of terrorism;’.

⁵² Paragraph 76 letters a) to f) of the EBA Guidelines on internal governance .

Competent authorities should verify that the terms of reference of the management body relating to corporate values ensure the adoption, promotion and implementation of high ethical and professional standards, creating an environment of effective challenge in which decision-making processes promote a range of views.

Consistently with Article 5(1), letter c) n. (ii), fifth indent of the RTS on information for authorisation , competent authorities should also review the outline of the policy promoting diversity of the management body and be satisfied that it is in line with the criteria set out in Article 88(2)(a) CRD and it sets a quantitative or, as appropriate, qualitative target for promoting diversity, and the frequency of assessment.

9.3.2 Conflicts of interest policy

Competent authorities should verify that the outline of the conflicts of interest policy makes the management body responsible for ‘establishing, approving and overseeing the implementation and maintenance of effective policies to identify, assess, manage and mitigate or prevent actual and potential conflicts of interest at institutional level’ as well as between the institution and the staff, including the management body and staff’s closest family members⁵³ .

⁵³ See sections 11 and 12 of the EBA Guidelines on internal governance .

With regard to conflicts of interest at the institution’s level, competent authorities should be satisfied that the outline of the conflicts of interest policy requires that ‘[i]nstitutions’ measures to manage or where appropriate mitigate conflicts of interest should be documented’⁵⁴ and includes appropriate segregation of duties, information barriers and procedures for transactions with related parties.

⁵⁴ See paragraph 107 of the EBA Guidelines on internal governance .

As to conflicts of interest at the staff level, competent authorities should be satisfied that the policy covers at least the situations envisaged in paragraph 109 of the EBA Guidelines on internal governance⁵⁵ , and that it envisages ‘procedures, measures, documentation requirements and responsibilities for the identification and prevention of conflicts of interest, for the assessment of their materiality and for taking mitigating measures’.

9.3.3 Whistleblowing, market abuse, product governance, consumer protection, complaints handling

⁵⁵ Paragraph 111 of the EBA Guidelines on internal governance reads: ‘The policy should cover at least the following situations or relationships where conflicts of interest may arise: a. economic interests (e.g. shares, other ownership rights and memberships, financial holdings and other economic interests in commercial customers, intellectual property rights, loans granted by the institution to a company owned by staff, membership in a body or ownership of a body or entity with conflicting interests); b. personal or professional relationships with the owners of qualifying holdings in the institution; c. personal or professional relationships with staff of the institution or entities included within the scope of prudential consolidation (e.g. family relationships); d. other employment and previous employment within the recent past (e.g. five years); e. personal or professional relationships with relevant external stakeholders (e.g. being associated with material suppliers, consultancies or other service providers); and f. political influence or political relationships’.

Competent authorities’ review of the outlines of the whistleblowing policy should ensure that staff may safely report potential or actual breaches of regulatory or internal requirements. To avoid conflicts of interest, it should be possible for staff to report breaches outside regular reporting lines. The alert procedures should ensure the protection of the personal data of both the person who reports the breach and the natural person who is allegedly responsible for the breach in accordance with Regulation (EU) 2016/679, General Data Protection Regulation.

Competent authorities should be satisfied that the outline of the policy covers the process for handling information on a potential or an actual breach and the protection of the person reporting it in line with the EBA Guidelines on internal governance .

Competent authorities’ review of the outline of the market abuse policy should ensure the credit institution’s adherence to appropriate standards preventing market abuse. In particular it should include the process for identifying, managing and reporting the market abuse infringements.

Competent authorities should verify that, in line with the EBA Guidelines on product oversight and governance arrangements for retail banking products⁵⁶ , the outline of the product governance policy ensures that the applicant credit institution, acting as manufacturer and/or distributor, will implement a sound product governance policy providing for internal processes, functions and strategies (i) to ensure that the interests, objectives and characteristics of consumers are taken into account, (ii) to avoid potential consumer detriment and (iii) to minimise conflicts of interest.

⁵⁶ EBA/GL/2015/18 available at https://www.eba.europa.eu/guidelines-on-product-oversight-and-governance-arrangements-for-retail-banking-products

Competent authorities’ review of the outline of the consumer protection policy should aim at ensuring that the applicant credit institution will establish a sound consumer protection policy to provide adequate information to and protection of consumers. In particular, the outlines should ensure that the consumer protection policy complies with the regulatory framework and provides adequate training to the relevant staff. To this end it should cover standards and principle, compliance monitoring and staff awareness.

Competent authorities’ review of the outlines of the complaints handling policy should aim at ensuring that the credit institution will provide consumers with adequate protection in compliance with the applicable regulatory requirements. The outline should cover the process for receiving, assessing and replying to complaints.